API Management and Security

APIs have shifted from a developer convenience to core infrastructure for modern digital business, enabling new business models, partner connectivity, and rapid delivery of services across homes, mobile devices, enterprise networks, cloud platforms, industrial environments, and the Internet of Things. The industry’s move toward lightweight RESTful APIs was accelerated by cloud adoption and mobile proliferation, but the market is now expanding beyond REST as GraphQL and gRPC become mainstream for flexibility and performance, and as cloud-native, loosely coupled architectures demand management capabilities that handle complex traffic and ephemeral container infrastructure. These shifts change security fundamentals as well: techniques like simple rate limiting can fail for GraphQL because requests to a single endpoint can vary dramatically in size and complexity, and the broadening scope of environments drives exponential growth in security-solution complexity.

API management capabilities are increasingly commoditized, pushing vendors to broaden functional coverage, involve more stakeholders, and improve developer productivity; some fold API management into wider enterprise integration platforms. In parallel, awareness of API security risk is rising due to large breaches and compliance pressure, fueling startups and innovation, especially in API discovery and monitoring. Yet comprehensive “one-stop” API security remains premature because the discipline spans many functional areas and lifecycle stages, despite ongoing market consolidation through acquisitions.

The recommended direction is an integrated strategy: treat API management and API security as components of a wider approach spanning development and operations, data protection, and compliance. Consistent governance and business continuity require proactive developer-oriented security, continuous monitoring with API-specific threat analysis, and risk-based, actionable automation for security teams. Hybrid deployment models are positioned as the most future-proof, with on-prem options retained for highly regulated environments.

• REST API adoption coincided with the exponential growth of cloud computing and mobile device proliferation.
• GraphQL and gRPC have evolved from research projects into widely adopted solutions for specific use cases.
• Rate limiting and quotas are insufficient for GraphQL because requests to the same endpoint can differ in size and complexity.
• A hybrid deployment model is described as the only flexible and future-proof option for comprehensive API management and security.
• A fully on-premises deployment is often preferred in highly sensitive or regulated environments.
• API discovery and security monitoring products remain the most popular class of solutions in the API security market.
• Market consolidation is continuing through acquisitions of small API-security startups by larger vendors.
• Overall Leaders listed are 42Crunch, Axway, Broadcom, Curity, Forum Systems, Google Apigee, Imperva, Red Hat, Salt Security, Sensedia, and WSO2.
• 42Crunch’s free IDE extensions have attracted over 200,000 users.
• Imperva acquired CloudVector in May 2021.

• “APIs have evolved into one of the foundations of modern digital business.”
• “In a world where digital information is one of the ‘crown jewels’ of many modern businesses… APIs are now powering the logistics of delivering digital products to partners and customers.”
• “API gateways for publishing REST API endpoints can certainly already be considered ‘legacy products’.”
• “With too many different types of infrastructure that need protecting, the overall complexity of security solutions grows exponentially.”
• “Expecting to find a ‘one-stop shop’ for API security is still a bit premature.”
• “In short, for a comprehensive API management and security architecture, a hybrid deployment model is the only flexible and future-proof option.”
• “Selecting a vendor of a product or service must not only be based on the information provided in a KuppingerCole Compass.”
• “Only by combining proactive application security measures for developers with continuous activity monitoring and deep API-specific threat analysis for operations teams… one can ensure consistent management, governance, and security of corporate APIs…”
• “Creating a well-planned strategy and reliable infrastructure to expose their business functionality… is a significant challenge that has to be addressed not just at the gateway level, but along the whole information chain…”
• “Innovation is not limited to delivering a constant flow of new releases.”